LEGAL INFORMATION · UPDATED 24 AUGUST 2026
Data protection
1. Data controller
Gregor Grimm, Hainstraße 17, 36251 Bad Hersfeld, Germany
E-mail: gregor-grimm@gmx.de
2. Provision and security of the website
When the website is accessed, technically necessary connection data are processed. This can include IP address, date and time, called file, transferred data volume, referrer, browser and operating system. The processing is necessary to deliver the website, detect attacks and ensure safe operation. The legal basis is Art. 6 para. 1 lit. f GDPR; Our legitimate interest lies in safe and stable operation.
3. Hosting and technical recipients
The website, including booking enquiries, availability checks and the protected administration area, is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes connection and form data needed for secure operation on our behalf. No external map or font services are integrated. Payment services are loaded only in the online booking area explicitly opened by you, if enabled.
4. Direct booking requests
If you use the form, we process the desired suite, travel period, number of people, name, e-mail address as well as voluntarily telephone number, message and request for an invoice. The purpose is to examine, respond to and, where appropriate, prepare or implement a tourist accommodation contract, including subsequent invoicing. The legal basis is Art. 6 para. 1 lit. b GDPR. Without the information marked as necessary, we cannot process the request.
5. Online payment with PayPal, card or Trustly
If the automatic online booking is activated and you start a payment, we process booking reference, accommodation, travel period, total amount, currency, payment method and payment status for the execution of the accommodation contract, payment processing, avoidance of double bookings and processing of cancellations, refunds and payment disputes. The legal basis is Art. 6 para. 1 lit. b GDPR; payment and booking documents to be kept by law are additionally processed by us according to art. 6 par. 1 lit. c GDPR.
For self-cancellation, the guest receives a random one-time link valid until check-in. We store only a cryptographic hash of its key, along with the timestamp, calculated refund and processing status. The key itself contains no name, email address or booking details.
For PayPal and card payments, the data recipient is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Bank payments within the PayPal payment flow additionally involve Trustly Group AB, Rådmansgatan 40, 5th floor, 113 57 Stockholm, Sweden. Card numbers, expiry dates and security codes are processed exclusively in hosted PayPal fields and are not sent to us. PayPal or Trustly processes payment, account, transaction, device and connection data as an independent controller. Further information is available in the PayPal Data Protection Declaration and the Trustly Data Protection Declaration.
According to its data protection information, PayPal can also process data outside the European Economic Area and uses the protective measures described there. Which payment methods are displayed depends on activation, country, device and the result of the payment provider’s technical aptitude test.
6. Contact by email
In the case of an e-mail, we process the information you provide to process your request. The legal basis is Art. 6 para. 1 lit. b GDPR for pre-contractual or contractual communication, otherwise art. 6 par. 1 lit. f GDPR.
7. Calendar and availability synchronisation
To avoid double bookings, occupancy and blocking periods are compared with Booking.com and Airbnb. The iCal calendar provided by this website does not contain names, email addresses or other contact details of guests. When using the portals, their data protection provisions also apply. As soon as a channel manager or property management system is used for automatic bookings, the booking and occupancy data required for the reservation are transmitted to this service; Providers and details are added here before the activation.
8. Data retention
We delete enquiries that did not lead to a booking and records of abandoned payments once they are no longer needed for processing, security, preventing abuse or possible claims. We retain records of confirmed bookings, payments, refunds and business correspondence in accordance with statutory commercial and tax obligations. Technical logs are deleted after the periods required for security and error analysis. Data held by payment services and external booking platforms is also subject to their own retention periods.
9. Cookies and access to your device
The basic website and the non-binding request form work without analytics, marketing or other unnecessary cookies. If you access the activated online booking area or select a payment method offered there, PayPal and Trustly can store or read technically necessary information in the browser in order to provide the selected payment securely, prevent fraud and transmit the payment status. Use for additional, non-necessary purposes will only take place if the legal requirements, including any necessary consent, are met.
10. Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent at any time with effect for the future. You may also complain to a data protection supervisory authority, particularly the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.
11. Automated tests
The online booking checks price, minimum stay and availability automatically. A booking will only be accepted according to verified payment status and confirmed inventory lock. Hain 17 does not use profiling for individual pricing. Payment providers may carry out their own automated security, fraud and authorization checks; Details result from their data protection notices. A non-binding form request remains independent of an automatic payment.
12. Optional guest reviews
On the homepage you can load additional reviews through Elfsight. A connection to Elfsight is only established after you click. This transmits information including your IP address and browser data; Elfsight may use cookies to count views. You can end the display at any time using “Close reviews”. Without activation, our selected review excerpts and links to the original sources remain available.
13. Optional advertising measurement with Google Ads
Google Ads loads only with your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its purpose is to attribute visits and confirmed bookings to ad clicks. Device and connection data, the page address without booking parameters and, after confirmed payment, the amount, currency and a pseudonymous transaction identifier are transmitted. Names, email addresses and payment access tokens are not transmitted. Personalised advertising and enhanced conversions are disabled. Google may process data in the USA. The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. We store your choice locally for six months. You can change or withdraw it at any time using “Privacy settings” in the footer. All booking functions remain available without consent.